Comment by jvanderbot
Comment by jvanderbot 6 days ago
You should try a CLI-based workflow for 2FA. As long as you can exfiltrate the secret (and you often can by pretending you can't scan QR codes), then you can use oathtool to generate passcodes.
1. use 'pass' to save the secret: 'pass edit work.secret' <enter it and quit>
2. use oathtool to generate 2fa given a secret:
' #!/bin/bash
oathtool -b --totp "`pass show $1.secret`" >&1 '
use it like '2fa work'
If you have 'xsel' you can even do
'oathtool -b --totp "`pass show $1.secret`" | xsel -ib'
to copy it to clipboard automatically.
Even if you only have the QR code, you can download the image or screenshot it and then extract the secret without ever having to use a smartphone by using zbarimg and then manually extracting the secret from the URI:
Output: If you have some 2FA that you need to enter 10 times per day, then you can also add a global shortcut to automatically paste it. Of course, this undermines the "second device" security. Some PC password managers also support 2FA, e.g. https://github.com/paolostivanin/OTPClient ( sudo apt install otpclient )